Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records
Summary
Helpfeel disclosed that an attacker exploited Gyazo's image upload server on September 11, accessing about 23.62 million user records and 490 million image metadata records. The vulnerable path was fixed the next day.
Key points
- Helpfeel said the attacker exploited a vulnerability in Gyazo's image upload infrastructure, gained arbitrary command execution, and accessed the service's database.
- Exposed user records included names, email addresses, password hashes, session identifiers, device identifiers, profile information, and integration-related data.
- About 490 million image metadata records were accessed, mostly for images uploaded before January 2019. Data included image identifiers, OCR text, source URLs, upload IP addresses, and EXIF location data where present.
- The records also included hashed passphrases for private images and information identifying private images; Helpfeel temporarily restricted access to some images.
- The vulnerable access path was remediated on September 12. The article says available evidence does not establish how stolen data has been used or whether affected images were subsequently viewed.
- Helpfeel advised users to change Gyazo passwords and reused or similar passwords. Organizations are advised to review Gyazo use, connected integrations, and screenshots that may contain sensitive information, and to watch for follow-on phishing.
Article Details
- Victim Organization
- Helpfeel (formerly Nota), affecting its Gyazo service
- Incident Type
- Unauthorized access and data breach after exploitation of a vulnerability in Gyazo's image upload infrastructure, enabling arbitrary command execution on an upload server
- Incident Date
- 2026-09-11
- Disclosure Date
- 2026-09-16
- Data Types Exposed
- Names
- Email addresses
- Password hashes
- Login session identifiers
- Device identifiers
- Profile information
- Integration-related data and tokens
- Image identifiers
- OCR-extracted text
- Source URLs
- Upload IP addresses
- User-agent strings
- Image titles
- EXIF location data where present
- Hashed passphrases for private images
- Information identifying private images
- Affected Records
- Approximately 23.62 million user records and approximately 490 million image metadata records
- Operational Impact
- Unauthorized access to stored data was confirmed. Helpfeel temporarily restricted access to some images. The source does not establish subsequent use of the stolen data or whether affected images were viewed.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed